KR101579764B1

KR101579764B1 - Electronic control unit

Info

Publication number: KR101579764B1
Application number: KR1020140151872A
Authority: KR
Inventors: 야스히코 하라다; 시즈오 마나베; 사토시 시즈카
Original assignee: 가부시키가이샤 덴소; 도요타지도샤가부시키가이샤
Priority date: 2013-11-22
Filing date: 2014-11-04
Publication date: 2015-12-24
Also published as: US20150148920A1; CN104657304B; JP6102692B2; CN104657304A; KR20150059600A; DE102014223839A1; US9720474B2; JP2015102964A

Abstract

The electronic control unit mounted on the object comprises: a rewritable memory (11, 21) of control and reprogramming software; An unillustrated power supply system microcomputer 20 operating in a control and reprogramming mode and being connected / disconnected from a power supply; And a constant power supply system microcomputer 10 that operates in a control and reprogramming mode and is fixedly connected to a power source. Each of the microcomputers includes a first mode determination device (S10) for determining whether or not the power supply is in an on-board mode when the power supply starts supplying power, a second mode determination Device < RTI ID = 0.0 > S20. The always-on power supply system microcomputer includes a first transition device for detecting a change in the power supply state of the uninterruptible power supply system microcomputer. The first transition device switches the processing to the determination performed by the first mode determination device when the power supply state is changed.

Description

[0001] ELECTRONIC CONTROL UNIT [0002]

The present disclosure relates to an electronic control unit including an always-on power supply system microcomputer and a not-always-on power supply system microcomputer.

As described in Patent Document 1, for example, an electronic control unit including a first microcomputer and a second microcomputer (hereinafter referred to as a microcomputer) has been conventionally proposed. Each microcomputer includes a nonvolatile memory in which data can be rewritten, and a communication circuit connected to the communication line. When each microcomputer receives data to be written addressed to itself through a communication circuit, it writes the data to be written into its nonvolatile memory and updates the data stored in the nonvolatile memory.

In such an electronic control unit described above, when at least one of the plurality of microcomputers updates the data stored in its nonvolatile memory, all the microcomputers execute a rewriting process in which data rewrite processing is executed in a control mode in which control processing is executed Mode is triggered. That is, the electronic control unit synchronizes a plurality of microcomputers with respect to the operation mode. This is intended to suppress the malfunction of the electronic control unit due to the collapse of the monitoring system between the microcomputers.

Some electronic control units operate with different power supply systems. For example, some electronic control units may be provided with the following power supply systems, i.e., non-permanent power supply systems in which power is turned on and off (that is, power is supplied and power is stopped) , And operates as a constant power supply system in which power is constantly supplied. In such an electronic control unit, the following microcomputer, that is, a microcomputer operating as an uninterruptible power supply system and a microcomputer operating as a constant power supply system may be provided.

If the electronic control unit is operating in the rewrite mode, the power supply to the microcomputer can be stopped. In this case, when the power supply to the microcomputer is resumed and rewrite is performed again, in the electronic control unit operating with different power supply systems, the microcomputer operating as the non-ordinary power supply system and the constant power supply system The timing of the start-up operation may vary between the microcomputers. Because of this, the electronic control unit can not synchronize the microcomputers with respect to the operation mode and can malfunction.

[Patent Document 1] Japanese Patent Application Publication No. 2006-268107 (corresponding to US2006 / 0227606A1)

An object of the present disclosure is to provide an electronic control unit in which a malfunction can be suppressed.

According to an aspect of the present disclosure, an electronic control unit mounted on an object comprises: a rewritable memory for storing control software and reprogramming software; Non-continuous power supply system operating in a control mode as an operating mode based on control software and operating in a reprogramming mode as an operating mode based on reprogramming software The microcomputer-reprogramming mode is provided for rewriting control software stored in memory The non-permanent power supply system microcomputer is connected to the power supply, receives power from the power supply according to a user operation, disconnects from the power supply, and stops supplying power according to a user operation. A constant power supply system operating in a control mode and a reprogramming mode. A microcomputer-always-on power supply system includes a microcomputer fixedly connected to a power source and receiving power from the power source without user intervention. Non-continuous power supply system Each of the microcomputer and the always-on power supply system microcomputer is configured to be in an on-board mode when the power source starts to supply power, A first mode determination device that determines whether the electronic control unit operates as a non-executed operation mode under the condition that the electronic control unit operates as a reprogramming mode and a control mode that are executed under the condition that the electronic control unit is mounted on the object; And a second mode determination device that determines whether the first mode determination device is not operating in the on-board mode, and determines whether the control software is to be operated in the reprogramming mode according to a determination as to whether or not the control software is normally written into the memory. If it is determined that the control software has not been normally written into the memory, the second mode determination device determines to operate in the reprogramming mode and instructs the other microcomputer to operate in the reprogramming mode. The first mode determination device determines that the first mode determination device does not operate in the on-board mode unless instructed to operate in the reprogramming mode. When the first mode determination device is instructed to operate in the reprogramming mode, the first mode determination device determines to operate in the on-board mode. The normal power supply system microcomputer includes a first transition device for detecting a change in the power supply state of the non-normal power supply system microcomputer when the operation is executed in the reprogramming mode and the control software is being rewritten . The first transition device switches the processing to the determination made by the first mode determination device when the first transition device detects that the power supply state has been changed.

As described above, the present disclosure comprises an uninterruptible power supply system microcircuit and a constant power supply system microcircuit. The always-on power supply system micro detects any change in the power supply state to the uninterrupted power supply system micro if the control software is being rewritten. When the always-on power supply system micro detects any change in the state of the power supply, the processing is caused to transition to the determination by the first mode determination device.

Therefore, according to the present disclosure, when the state of the power supply to the non-continuous power supply system micro is changed from the stop state to the supply state while the normal power supply system microcomputer executes the rewrite processing, The always-on power supply system micro executes the determination by the first mode determination device. That is, according to the present disclosure, it is possible to synchronize the constant power supply system micro and the non-constant power supply system micro with respect to the execution timing of the determination by the first mode determination device.

Therefore, according to the present disclosure, even when the state of the power supply to the non-continuous power supply system micro is changed from the stop state to the supply state while the constant power supply system microcomputer executes the rewrite processing, Does not instruct the non-permanent power supply system micro to operate in the reprogramming mode. Therefore, according to the present disclosure, it is possible to suppress the non-continuous power supply system microcomputer from operating in the on-board mode while the constant-current power supply system microcomputer executes rewrite processing. As a result, according to the present disclosure, malfunction can be suppressed.

Even when the state of the power supply to the non-continuous power supply system microcomputer is changed from the supply state to the stop state while the constant power supply system micro is rewriting the control software, the constant power supply system micro- The determination by the mode determination device is executed. At this time, the non-permanent power supply system microphones of the present disclosure do not operate because the power supply to them is stopped.

Therefore, according to the present disclosure, it is possible to suppress the non-continuous power supply system microcomputer from operating in the on-board mode while the always-on power supply system microcomputer executes the rewrite processing. As a result, according to the present disclosure, malfunction can be suppressed.

The above and other objects, features and advantages of the present disclosure will become more apparent from the following detailed description with reference to the accompanying drawings.
1 is a block diagram showing a schematic configuration of an ECU in the embodiment;
Fig. 2 is a flow chart showing the processing operation of each microcomputer in the embodiment; Fig.
3 is a flow chart illustrating the processing operation of the constant power supply system microcomputer in the on-
Fig. 4 is a flowchart showing the processing operation of the constant power supply system microcomputer in the control mode in the embodiment; Fig.
Fig. 5 is a timing chart showing the processing operation of the ECU in the embodiment, which occurs when the instantaneous microcomputer always re-writes to the flash ROM and instantaneous interruption of power to the microcomputer occurs,
6 is a timing chart showing the processing operation of the ECU in the embodiment, which occurs when the non-permanent microcomputer re-writes to the flash ROM and momentary interruption of power to the non-permanent microcomputer occurs,
Fig. 7 is a timing chart showing the processing operation of the ECU in the embodiment, which occurs when the non-permanent microcomputer re-writes to the flash ROM and the instantaneous interruption of power to the microcomputer always occurs;
8 is a table showing combinations of instantaneous interruption of power supply in the ECU and states of the flash ROM after instantaneous interruption,
FIG. 9 is a timing chart showing the processing operation of the ECU in the comparative example, which occurs when the instantaneous microcomputer always rewrites the flash ROM and instantaneous interruption of power to the microcomputer occurs;
10 is a timing chart showing the processing operation of the ECU in the comparative example, which occurs when the non-permanent microcomputer re-writes to the flash ROM and momentary interruption of power to the non-permanent microcomputer occurs,
Fig. 11 is a timing chart showing the processing operation of the ECU in the comparative example, which occurs when the non-permanent microcomputer re-writes to the flash ROM and the instantaneous interruption of power to the microcomputer always occurs.

(Embodiment 1)

In the following, a description will be given of a number of embodiments for implementing the present invention with reference to the drawings. In the description of these embodiments, an example in which the electronic control unit of the present invention is applied to the ECU 100 is employed. The ECU 100 is mounted on an object to be mounted. The object to be mounted is, for example, a vehicle. In these embodiments, the ECU 100 is mounted on the vehicle. ECU stands for Electronic Control Unit.

First, a description of the configuration of the ECU 100 will be provided with reference to FIG. The ECU 100 mainly includes a constant power supply system microcomputer 10, an uninterruptible power supply system microcomputer 20, an operation mode monitoring IC 30, a determination unit 40, and the like. The ECU 100 is connected to the rewriter 200. Hereinafter, the always-on power supply system microcomputer may be referred to as a microcomputer at all times, and the non-ordinary power supply system microcomputer may be referred to as a non-always-occurring microcomputer. If the always-on microcomputer 10 and the non-always-on microcomputer 20 do not need to be distinguished from one another, they will simply be referred to as micros.

The rewriter 200 is connected to the constant power supply microcomputer 10 and the non-constant power supply microcomputer 20 via a communication line to be described below. The rewriter 200 is a device for always rewriting the control software stored in the flash ROMs 11 and 21 used in the microcomputer 10 and the non-permanent microcomputer 20 at all times. For example, the rewriter 200 transmits a new control software and a program for updating control software to the microcomputer 10 and the non-always-on microcomputer 20 at all times.

The always-on microcomputer 10 includes an operation unit, a storage unit, and an input / output unit. The always-on microcomputer 10 is always connected to the power source 110 to receive power at all times. The constant power source 110 includes, for example, a battery mounted in a vehicle and a power supply path for connecting the battery and the microcomputer 10 at all times without intervention of an ignition switch. Therefore, in other words, the always-on microcomputer 10 is fixedly connected to the battery regardless of the operation of the user and receives power from the battery. However, the always-on microcomputer 10 can be stopped instantaneously (that is, only for a short time) because the power supply to the constant power source 110 or the like is any failure. That is, the always-on microcomputer 10 can stop the power supply to it due to the so-called instantaneous cut-off. The battery corresponds to the power source. The start of the power supply to the microcomputer in which the power supply is interrupted can be interpreted as the restart of the microcomputer or the start of the operation of the microcomputer.

The normal microcomputer 10 includes a flash ROM 11, a flash ROM management unit 12, an operation mode selection unit 13, an operation mode reception unit 14, an operation mode transmission unit 15, 16).

The flash ROM 11 is always included in the storage unit of the microcomputer 10. [ Although not shown in the drawings, the always-on microcomputer 10 may include a RAM or the like and a flash ROM 11 as a storage unit. ROM stands for Read Only Memory. RAM is an acronym for Random Access Memory.

The flash ROM 11 corresponds to a memory. The flash ROM 11 is a rewritable semiconductor memory in which the content is not erased even when the power supply is stopped. In the flash ROM, control software and reprogramming software are stored. The flash ROM 11 may be referred to as flash memory.

The always-on microcomputer 10 operates based on the control software and the reprogramming software stored in the flash ROM 11. That is, the always-on microcomputer 10 operates in a reprogramming mode used to rewrite the control software stored in the flash ROM 11 as a control mode, which is an operation mode based on control software, and an operation mode, which is based on reprogramming software . In other words, the always-on microcomputer 10 operates in the control mode and the reprogramming mode by its own operating unit which executes the arithmetic processing according to the control software stored in the flash ROM 11 and the reprogramming software.

The control mode is an operation mode for executing control for vehicle operation. The reprogramming mode is for rewriting the control software and will be referred to as a rewrite mode or a reprogramming mode. More specifically, the reprogramming mode is for reprogramming the ECU 100 mounted on the vehicle. The normal microcomputer 10 transmits a rewrite request from the operation mode transmitting section 15 when operating in the reprogramming mode. If either the permanent microcomputer 10 or the non-permanent microcomputer 20 is executing the rewrite processing, the other microcomputer (that is, the microcomputer that is not executing the rewrite processing) enters a standby state.

The always-on microcomputer 10 can operate in an on-board mode, a control mode, and a reprogramming mode. The on-board mode is an operation mode in which the ECU 100 operates while being removed from the vehicle, that is, the ECU 100 operates in a single mode. In other words, the on-board mode is for rewriting the flash ROM 11 in the separate ECU 100 to which the rewriter 200 is connected. Therefore, the ECU 100 does not operate in the on-board mode while being mounted on the vehicle. As described above, the on-board mode is an operation mode in which the ECU 100 is not established while being mounted on the vehicle.

The on-board mode is for rewriting the flash ROM 11 as in the reprogramming mode. However, the reprogramming mode is established while the ECU 100 is mounted on the vehicle, while the on-board mode is established with the ECU 100 removed from the vehicle. Therefore, the reprogramming mode can be referred to as an on-vehicle reprogramming mode, and the on-board mode can be referred to as on-board reprogramming mode. That is, in the description of these embodiments, if the reprogramming mode is simply referred to, it represents an on-vehicle reprogramming mode.

The flash ROM management unit 12, the operation mode selection unit 13 and the non-regular power supply monitoring unit 16 are always included in the operation unit of the microcomputer 10. The operation mode receiving unit 14 and the operation mode transmitting unit 15 are always included in the input / output unit of the microcomputer 10. The normal microcomputer 10 is a functional block that can be executed by itself and includes a flash ROM management unit 12, an operation mode selection unit 13, an operation mode reception unit 14, an operation mode transmission unit 15, And a normal power supply monitoring unit 16.

The flash ROM management unit 12 determines whether the control software is normally being written into the flash ROM 11 or not. For example, if an instantaneous interruption of power to the microcomputer 10 occurs at all times while operating in the reprogramming mode, the writing to the flash ROM 11 is interrupted. In this case, the control software is not normally written in the flash ROM 11. That is, the state in which the control software is not normally written in the flash ROM 11 can be interpreted as an abnormality of the flash ROM. Therefore, the flash ROM management unit 12 detects an abnormality of any flash ROM in the flash ROM 11. [

The operation mode selection unit 13 determines whether there is a rewrite request or not, and selects an operation mode based on the result of this determination. More specifically, the operation mode selection section 13 selects, as an operation mode, a control mode, a control mode, and a control mode in accordance with a rewrite request from the operation mode reception section 14 and an abnormality detection result of the flash ROM in the flash ROM management section 12 A programming mode, and an on-board mode.

The operation mode receiving unit 14 receives a rewrite request from the non-permanent microcomputer 20. The operation mode receiving unit 14 receives the rewrite request received via the determination unit 40, which will be described below. The operation mode transmitting unit 15 transmits a rewrite request to the non-permanent microcomputer 20. The operation mode transmitting section 15 transmits a rewrite request via the determination unit 40, which will be described below.

The non-continuous power supply monitoring unit 16 detects any change in the power supply state to the non-permanent microcomputer 20. That is, the non-regular power supply monitoring unit 16 determines whether the state of power supply to the non-permanent microcomputer 20 has changed from the supplied state to the stopped state and whether the power supply state to the non-permanent microcomputer 20 has been stopped State to the supply state. This means that the non-regular power supply monitoring unit 16 determines whether the power supply to the non-permanent microcomputer 20 has been stopped and the power supply to the non-permanent microcomputer 20 that has been stopped has started will be. The non-permanent microcomputer 20 switches between turning on or off the ignition switch so that power is supplied thereto or power supply is stopped. Therefore, this can be interpreted that the non-continuous power supply monitoring section 16 determines whether the ignition switch has transitioned from on to off or from off to on.

Like the always microcomputer 10, the non-permanent microcomputer 20 includes an operating unit, a storage unit, an input / output unit, and the like. The non-permanent microcomputer 20 is connected to the non-permanent power source 120, connected to the battery by the user's operation and supplied with electric power, disconnected from the battery by user's operation, and the power supply is stopped. The non-permanent power source 120 includes, for example, a battery mounted on a vehicle, and a power supply path connecting the battery and the non-permanent microcomputer 20 via an ignition switch. Therefore, the non-permanent microcomputer 20 is connected to the battery by the user turning on the ignition switch, supplied with electric power, disconnected from the battery by the user turning off the ignition switch, and the power supply is stopped. However, the power supply to the non-permanent microcomputer 20 can be stopped by the momentary interruption due to the failure of the non-permanent power supply 120 or the like irrespective of the state of the ignition switch.

The non-permanent microcomputer 20 includes a flash ROM 21, a flash ROM management unit 22, an operation mode selection unit 23, an operation mode reception unit 24, an operation mode transmission unit 25, and the like.

The flash ROM 21 corresponds to a memory. Since the flash ROM 21 is the same as the flash ROM 11, a detailed description thereof will be omitted. The non-permanent microcomputer 20 may include a RAM or the like and a flash ROM 21 as a storage unit.

Like the always-on microcomputer 10, the non-permanent microcomputer 20 operates based on control software and reprogramming software stored in flash ROM 21. That is, the non-permanent microcomputer 20 has a control mode, which is an operation mode based on the control software, and an operation mode based on the reprogramming software, in the reprogramming mode used to rewrite the control software stored in the flash ROM 21 . The non-permanent microcomputer 20 may operate in an on-board mode, a control mode and a reprogramming mode.

The flash ROM management unit 22 and the operation mode selection unit 23 are included in the operation unit of the non-permanent microcomputer 20. The operation mode receiving unit 24 and the operation mode transmitting unit 25 are included in the input / output unit of the non-permanent microcomputer 20. In other words, the non-permanent microcomputer 20 is a function block that can be executed by itself, and includes a flash ROM management section 22, an operation mode selection section 23, an operation mode reception section 24 and an operation mode transmission section 25 . The flash ROM management unit 22, the operation mode selection unit 23, the operation mode reception unit 24 and the operation mode transmission unit 25 are connected to the flash ROM management unit 12, the operation mode selection unit 13, 14 and the operation mode transmitting unit 15, respectively. Therefore, detailed descriptions of the flash ROM management unit 22, the operation mode selection unit 23, the operation mode reception unit 24, and the operation mode transmission unit 25 will be omitted.

The flash ROM management unit 22 determines whether the control software is normally being written to the flash ROM 21. [ For example, if an instantaneous interruption of power to the non-permanent microcomputer 20 occurs while operating in the reprogramming mode, the writing to the flash ROM 21 is blocked. In this case, the control software is not normally written into the flash ROM 21. That is, the state in which the control software is not normally written in the flash ROM 21 can be interpreted as an abnormality of the flash ROM. Therefore, the flash ROM management section 22 detects an abnormality of any flash ROM in the flash ROM 21. [

The operation mode selection unit 23 determines whether there is a rewrite request or not, and selects an operation mode based on the result of the determination. More specifically, the operation mode selection section 23 selects, as an operation mode according to a rewrite request from the operation mode reception section 24 and a detection result of a flash ROM abnormality in the flash ROM management section 22, Mode and the on-board mode.

The operation mode receiving unit 24 always receives a rewrite request from the microcomputer 10. The operation mode receiving unit 24 receives a rewrite request, which is received via the determination unit 40, which will be described below. The operation mode transmitting unit 25 always transmits a rewrite request to the microcomputer 10. The operation mode transmitting unit 25 transmits a rewrite request via the determination unit 40, which will be described below.

The operation mode monitoring IC 30 monitors the operation modes of the microcomputer 10 and the microcomputer 20 at all times. In other words, the operation mode monitoring IC 30 can control the operation mode of the microcomputer 10 at all times and the operation mode of the non-permanent microcomputer 20, Is established. When the operation mode monitoring IC 30 detects that the on-board mode has been established, it always issues a reset to the microcomputer 10 and the non-permanent microcomputer 20. The operation mode monitoring IC 30 issues a reset to the always-on microcomputer 10 and the non-always-on microcomputer 20 when the ECU 100 detects that the on-board mode has been established while the ECU 100 is mounted on the vehicle. If either the normal microcomputer 10 or the non-permanent microcomputer 20 is operating in the on-board mode, the operation mode monitoring IC 30 issues a reset to the microcomputer operating in the on-board mode .

In the on-board reprogramming mode, the always-on microcomputer 10 and the non-always-on microcomputer 20 operate, for example, as firmware specific to the microcomputer manufacturer. For this reason, the always-on microcomputer 10 or the non-always-on microcomputer 20 does not output a WDC signal or the like indicating that the control is normal. As a result, the ECU 100 detects any abnormality in the operation of the always-on microcomputer 10 and the non-always-on microcomputer 20 by the operation mode monitoring IC 30 having the hardware type monitoring function. WDC stands for Watch Dog Clear.

The normal microcomputer 10 and the non-permanent microcomputer 20 may be configured to monitor the operation state of each other using a WDC signal or the like. However, if the always-on microcomputer 10 and the non-always-on microcomputer 20 can not be synchronized with one another for an operating mode, i.e., one is a control mode and the other is a reprogramming mode, the monitoring system between them collapses . For this reason, if the always-on microcomputer 10 and the non-always-on microcomputer 20 can not be synchronized with each other for the operation mode, a reset is periodically issued due to the output stop of the WDC signal. As a result, the microcomputer operating in the control mode determines that the state of the microcomputer operating in the reprogramming mode is abnormal.

The determination unit 50 determines whether or not the always-on microcomputer 10 and the non-always-on microcomputer 20 are in a reprogramming mode as a control mode. The determination unit 50 determines whether or not the rewrite request for the always-on microcomputer 10 transmitted from the operation mode transmitting unit 25 and the rewrite request for the non-always-on microcomputer 20 transmitted from the operation mode transmitting unit 15 . When either the permanent microcomputer 10 or the non-permanent microcomputer 20 transmits a rewrite request, the determination unit 50 always requests the microcomputer 10 and the non-permanent microcomputer 20 to rewrite Lt; / RTI > If neither the always microcomputer 10 nor the non-always-on microcomputer 20 sends a rewrite request, the determination unit 50 will always inform the microcomputer 10 or the non-permanent microcomputer 20 of a rewrite request Lt; / RTI > For example, the operation mode transmitting unit 15 and 25 may cause the request signal indicating the rewrite request to be at the HIGH level to transmit the rewrite request, the request signal to be low (LOW) level. Accordingly, the ECU 100 can always synchronize the microcomputer 10 and the non-permanent microcomputer 20 more easily with respect to the operation mode.

However, in the case of the ECU including the always-on microcomputer and the non-always-on microcomputer, if the instantaneous cut-off occurs in each microcomputer, the start of power supply to these microcomputers may be disrupted. In other words, in the case of the ECU including the always-on microcomputer and the non-always-on microcomputer, when the instantaneous interruption occurs in each microcomputer, the timing of start of operation of each microcomputer can be changed.

The processing operation of the ECU 100 will be described with reference to Figs. 2 to 7. Fig. First, the processing operation of the ECU 100 will be described using the flowcharts of Figs.

When the power supply to each of the normal microcomputer 10 and the non-permanent microcomputer 20 is started, they execute the processing shown in the flow chart of FIG. However, the normal microcomputer 10 and the non-permanent microcomputer 20 have different processing details in steps S40 and S50. The non-permanent microcomputer 20 executes the control for the vehicle operation in step S40, and rewrites the control software in step S50. On the other hand, in addition to the control for the vehicle operation in step S40, the always-on microcomputer 10 executes the determination shown in step S41, and in addition to rewriting the control software in step S50, And executes the determination. When the power supply to each of the normal microcomputer 10 and the non-permanent microcomputer 20 is stopped, they terminate the series of processing shown in the flow chart of FIG.

In step S10, the microcomputer determines whether the operation should be executed in the on-board reprogramming mode (first mode determination device). Each of the operation mode selectors 13 and 23 determines whether an operation should be performed on the on-board basis based on the presence / absence of a rewrite request outside the microcomputer. I will explain in more detail. If there is no instruction to operate in the reprogramming mode, each of the operation mode selectors 13 and 23 determines that the operation should not be executed in the on-board mode. If there is an instruction to operate in the reprogramming mode, they determine that the operation should be performed in the on-board mode. If it is determined that the operation should not be executed in the on-board mode, the operation mode selection units 13 and 23 proceed to step S20. If it is determined that the operation should be executed in the on-board mode, the operation mode selection units 13 and 23 proceed to step S60.

In step S20, it is determined whether the flash ROM is abnormal (second mode determination device). If it is determined in step S10 that the operation should not be executed in the on-board mode, each of the always-on microcomputer 10 and the non-always-on microcomputer 20 determines whether the flash ROM is abnormal.

At this time, the flash ROM management unit 12 determines whether the control software is normally written in the flash ROM 11 or not. If the flash ROM management section 12 determines that the control software is normally being written to the flash ROM 11, it is regarded that the flash ROM is not abnormal. That is, the flash ROM management unit 12 regards the flash ROM 11 as normal if the control software determines that the control software is normally being written into the flash ROM 11. If the flash ROM management unit 12 judges that the control software is not normally being written into the flash ROM 11, the flash ROM is regarded as abnormal. Similarly, the flash ROM management section 22 determines whether or not the flash ROM is abnormal depending on whether the control software is normally being written to the flash ROM 21 or not.

If each of the flash ROM management units 12 and 22 determines that the flash ROM is not abnormal, they proceed to step S30. If each of the flash ROM management units 12 and 22 determines that the flash ROM is abnormal, they assume that the operation should be executed in the reprogramming mode and proceed to step S50. As described above, each of the normal microcomputer 10 and the non-normal microcomputer 20 must be operated in the reprogramming mode depending on whether the control software is normally written in the flash ROM 11 or 21 Or not.

If each of the normal microcomputer 10 and the non-normal microcomputer 20 regards that the operation should be executed in the reprogramming mode, it directs the microcomputer to operate in the non-self-reprogrammed mode. For example, if the flash ROM management unit 12 considers that the operation should be executed in the reprogramming mode, the operation mode transmitting unit 15 transmits a rewrite request to the non-permanent microcomputer 20, To operate in the program mode.

In step S30, it is determined whether the operation should be executed in an on-vehicle reprogramming mode (third mode determination device). If it is determined in step S20 that the operation should not be executed in the reprogramming mode, the always-on microcomputer 10 and the non-always-on microcomputer 20 determine whether the operation should be executed in the control mode. At this time, each operation mode selection section (13, 23) judges whether or not the operation should be executed in the control mode based on the presence / absence of the switching request from the determination unit (40). If the operation mode selecting sections 13 and 23 judge that the operation should not be executed in the control mode, they proceed to step S50. If they determine that the operation should be executed in the control mode, they proceed to step S40. It is preferable that each of the operation mode selection units 13 and 23 executes the determination in step S30 after waiting for a specific period after the determination of No in step S20. This makes it possible to reliably receive the output of the rewrite request signal on the other side as indicated by time t14 in Fig. 6 and time t24 in Fig.

In step S40, each of the permanent microcomputer 10 and the non-permanent microcomputer 20 operates in the control mode. In step S50, each of the permanent microcomputer 10 and the non-permanent microcomputer 20 operates in the reprogramming mode. In step S60, each of the normal microcomputer 10 and the non-permanent microcomputer 20 operates in an on-board mode.

The processing operation of the always-on microcomputer 10 in the reprogramming mode will be described with reference to Fig. The always-on microcomputer 10 executes the determination in step S51 while operating in the reprogramming mode.

In step S51, it is determined whether or not the state of the non-continuous power source is changed (first transition device). At this time, the non-regular power supply monitoring unit 16 detects any change in the state of the power supply to the non-permanent microcomputer 20. In other words, the non-always-on power supply monitoring unit 16 detects start-up and falling of the non-always-on microcomputer 20.

When the non-continuous power supply monitoring section 16 detects that the state of the power supply has been changed, the determination at step S10 causes the processing to shift (i.e., shift the processing). That is, when the microcomputer 10 always detects that the state of the power supply to the non-permanent microcomputer 20 has been changed during the operation in the reprogramming mode (during the execution of the rewrite processing) And performs processing to initialize it to the state just before the start. If the non-always-on power supply monitoring section 16 detects no change in the state of the power supply, the processing of step S51 is repeatedly executed.

The processing operation of the always-on microcomputer 10 in the control mode will be described with reference to Fig. The always-on microcomputer 10 executes the determination in step S41 while operating in the control mode.

In step S41, the start of the non-continuous power source is judged (second transition device). At this time, the non-regular power supply monitoring unit 16 determines whether the state of power supply to the non-permanent microcomputer 20 has changed from the stopped state to the supplied state.

When the non-continuous power supply monitoring section 16 detects that the state of the power supply to the non-permanent microcomputer 20 is changed from the stop state to the supply state, the processing is shifted to the judgment of step S30. If the non-continuous power supply monitoring section 16 can not detect that the state of the power supply to the non-permanent microcomputer 20 has been changed from the stop state to the supply state, the processing of step S41 is repeatedly executed.

The processing operation of the ECU 100 will be described with reference to the timing charts of Figs. Here, the processing operation of the ECU 100 is described with reference to Figs. 9 to 11, which are timing diagrams showing the processing operation of the ECU in the comparative example, and a comparison with the processing operation of the ECU in the comparative example Will be explained.

Similar to the ECU 100, the ECU in the comparative example includes an always-on microcomputer and a non-always-on microcomputer, and performs the same processing as shown in the flowchart of Fig. However, in the ECU in the comparative example, the non-permanent microcomputer and the always-on microcomputer do not execute the determination in step S41 or S51.

In the ECU and ECU 100 in the comparative example including the always-on microcomputer and the non-always-on microcomputer, a combination of states of the flash ROM after the instantaneous power cutoff and instantaneous cutoff shown in Fig. 8 may occur.

The first combination corresponds to the case where an instantaneous interruption of power to the always-on microcomputer occurs while the non-permanent microcomputer is rewriting to the flash ROM. In this case, the status of the flash ROM after the instantaneous interruption becomes abnormal in the non-permanent microcomputer. That is, the control software for the non-permanent microcomputer is not normally written to the flash ROM.

The second combination corresponds to the case where the momentary interruption of power to the non-permanent microcomputer occurs while the non-permanent microcomputer is rewriting to the flash ROM. In this case, the state of the flash ROM after the instantaneous interruption is abnormal in non-permanent microcomputer software. That is, the control software for the non-permanent microcomputer is not properly written into the flash ROM.

The third combination corresponds to the case where an instantaneous interruption of power to the microcomputer always occurs while the microcomputer is always rewriting to the flash ROM. In this case, the status of the flash ROM after the instantaneous interruption is always abnormal with the microcomputer software. That is, the control software for the always-on microcomputer is not normally written to the flash ROM.

The fourth combination corresponds to the case where an instantaneous interruption of power to the non-permanent microcomputer occurs while the microcomputer is always rewriting to the flash ROM. In this case, the state of the flash ROM of the instantaneous interruption is not always abnormality of the microcomputer software or abnormality of the microcomputer software. That is, the instantaneous interruption of the power to the non-permanent microcomputer does not cause the control software for the permanent microcomputer or the control software for the non-permanent microcomputer to be normally written.

There is a possibility that the ECU of the comparative example becomes abnormal in any of the four combinations. These four cases will be described in detail using a timing diagram.

First, I will explain the third combination. If the instantaneous microcomputer always rewrites the flash ROM and momentary interruption of power to the microcomputer always occurs, the ECU of the comparative example operates as shown in the timing diagram of Fig.

When the always-on microcomputer causes the instantaneous interruption of the power to the always-on microcomputer while the rewrite processing is being executed as shown at time t31, the rewriting processing is interrupted in all microcomputers in the ECU of the comparative example. That is, the rewrite processing is interrupted in the always-on microcomputer and the non-always-on microcomputer.

Thereafter, when the power supply to the always-on microcomputer is restored as shown at time t32, the reset is always released from the microcomputer and the processing in the flowchart of Fig. 2 is started (S). At this time, the power supply to the non-permanent microcomputer is stopped. Therefore, the always-on microcomputer proceeds to step S20 following step S10.

In the determination of step S20, the always-on microcomputer detects the abnormal state of the flash ROM as indicated at time t33, and proceeds to the reprogramming mode at step S50 to resume the rewriting of the flash ROM. Since the always-on microcomputer operates in the reprogramming mode, it sends a rewrite request as shown at time t33. As a result, the rewrite request is transmitted to the non-normal microcomputer.

Thereafter, when the power supply is started, the non-permanent microcomputer starts the processing in the flowchart of FIG. 2 (S). At this time, the rewrite request has already been transmitted to the microcomputer at time t33. For this reason, in step S10, the non-permanent microcomputer determines that the operation should be executed in the on-board mode as shown at time t34. As a result, the non-permanent microcomputer proceeds to the on-board mode of step S60. That is, the non-permanent microcomputer enters the on-board mode even if the ECU of the comparative example is operating in the vehicle. As a result, the operation mode monitoring IC detects that the operation is on-board mode as shown at time t35, and issues a reset to the non-permanent microcomputer.

On the other hand, the ECU 100 operates as shown in the timing diagram of Fig. When the always-on microcomputer 10 receives the interruption of the power supply to the microcomputer at all times while executing the rewrite processing as shown at time t1, the rewrite processing of all the microcomputers in the ECU 100 is interrupted. That is, the rewrite processing is interrupted in the always-on microcomputer 10 and the non-always-on microcomputer 20.

Then, as shown at time t2, when the power supply to the always-on microcomputer is restored, the reset is always released from the microcomputer 10 to start the processing in the flow chart of FIG. 2 (S). At this time, the power supply to the non-permanent microcomputer 20 is stopped. Therefore, the always-on microcomputer 10 goes to step S10 in step S20.

In the determination at step S20, the microcomputer 10 always detects the abnormal state of the flash ROM, and proceeds to the reprogramming mode at step S50 as shown at t3 to resume the rewriting of the flash ROM. Also, while the microcomputer 10 is always operating in the reprogramming mode, the non-continuous power supply monitoring section 16 detects any change in the state of the power supply to the non-permanent microcomputer 20 S51).

Thereafter, when the power supply is started as shown at t4, the non-permanent microcomputer 20 starts the processing in the flowchart of Fig. 2 (S). At this time, in the always-on microcomputer 10, in step S51, the non-regular power supply monitoring unit 16 detects a change in the state of power supply to the microcomputer 20 in an unaided state. That is, it detects the start of the non-permanent microcomputer 20. Therefore, the always-on microcomputer 10 is initialized to the state just before the power supply to itself starts as a result of the change of the state of the power supply to the non-permanent microcomputer 2 while operating in the reprogramming mode. That is, the always-on microcomputer 10 starts the processing in the flowchart of FIG. 2 (S). Then, the always-on microcomputer 10 executes the processing of step S10 again. In other words, the always-on microcomputer 10 again transitions from the reprogramming mode in step S50 to step S10.

As a result, the always-on microcomputer 10 and the non-always-on microcomputer 20 execute step S10 in the flowchart of Fig. As described above, the ECU 100 can always synchronize the microcomputer 10 and the non-permanent microcomputer 20 with respect to each other for the operation mode.

Since each of the always-on microcomputer 10 and the non-always-on microcomputer 20 is not instructed to perform reprogramming, it is determined in step S10 that the operation should not be executed in the on-board mode as shown at time t5 . As a result, each of the normal microcomputer 10 and the non-permanent microcomputer 20 proceeds to step S20.

The non-permanent microcomputer 20 does not detect any abnormality of the arbitrary flash ROM in step S20, so the process proceeds to the judgment of step S30. On the other hand, the always-on microcomputer 10 detects the abnormal state of the flash ROM in the determination in step S20, and proceeds to the reprogramming mode in step S50 to resume the rewriting of the flash ROM 11. Therefore, the microcomputer 10 can always rewrite the flash ROM 11 again. Since the always-on microcomputer 10 operates in the reprogramming mode, it sends a rewrite request as shown at time t6. That is, the rewrite request is transmitted to the non-permanent microcomputer 20 as indicated at time t6.

Unlike the ECU of the comparative example, at this time, the non-permanent microcomputer 20 has completed the determination of step S20 and therefore does not enter the on-board mode. Since the non-permanent microcomputer 20 receives the switching request from the determination unit 40 in the determination in step S30, the non-permanent microcomputer 20 proceeds to the reprogramming mode in step S50. In other words, in the determination of step S30, the non-permanent microcomputer 20 shifts to the reprogramming mode because it detects the switching request. As a result, the flash ROM 21 can be rewritten in the non-permanent microcomputer 20 as well. As described above, the non-permanent microcomputer 20 has completed the determination of step S10 before the microcomputer 10 always issues the rewrite request, so that the determination in step S30 can be made to transition to the on- have.

The second and fourth combinations will be described. When any one of the normal microcomputer or the non-permanent microcomputer is momentarily interrupting power to the non-permanent microcomputer while writing to its flash ROM, the ECU of the comparative example operates as shown in the timing diagram of FIG.

If the momentary interruption of power to the non-permanent microcomputer occurs at time t41 while the non-permanent microcomputer is performing the rewrite processing, the non-permanent microcomputer rewrite processing is interrupted. On the other hand, the always-on microcomputer continues the reprogramming mode. That is, rewrite processing is blocked only in the non-permanent microcomputer.

When the power supply to the non-permanent microcomputer is restored as shown at time t42, the reset is released from the non-permanent microcomputer and the processing in the flow chart of FIG. 2 is started (S). At this time, the microcomputer is always operating in the reprogramming mode, and therefore transmits a rewrite request. As a result, the rewrite request is transmitted to the non-normal microcomputer.

For this reason, as shown at time t43, the non-permanent microcomputer determines that the operation should be executed in the on-board mode in step S10. As a result, the non-permanent microcomputer proceeds to the on-board mode of step S60. That is, even if the ECU of the comparative example is operating in the vehicle, the non-permanent microcomputer enters the on-board mode. As a result, the operation mode monitoring IC detects that the operation is being performed in the on-board mode as shown at time t44, and issues a reset to the non-permanent microcomputer.

Similarly, even when the instantaneous microcomputer is performing the rewrite processing and the momentary interruption of the power to the non-permanent microcomputer occurs at time t41, the always-on microcomputer continues the rewrite processing, Becomes an instantaneous blocking state. Thereafter, when the power supply to the non-permanent microcomputer is restored at time t42, the reset is released from the non-permanent microcomputer. Therefore, when the power supply is started, the non-permanent microcomputer starts the processing in the flow chart of FIG. 2 (S). At this time, the rewrite request is transmitted to the non-permanent microcomputer at time t42. For this reason, the non-permanent microcomputer determines in step S10 that the operation should be executed in the on-board mode. As a result, the non-permanent microprocessor proceeds to the on-board mode of step S60. That is, even when the ECU of the comparative example is operating in the vehicle, the non-permanent microcomputer enters the on-board mode. As a result, the operation mode monitoring IC detects that the operation is being performed in the on-board mode at time t44, and issues a reset to the non-permanent microcomputer.

On the other hand, the ECU 100 operates as shown in the timing chart of Fig. If the momentary interruption of power to the non-permanent microcomputer 20 occurs as the non-permanent microcomputer 20 is executing the rewrite processing, as shown at time t11, the rewrite processing of the non-permanent microcomputer 20 .

On the other hand, in the always-on microcomputer 10, in step S51, the non-regular power supply monitoring section 16 changes the power supply state to the non-permanent microcomputer 20, that is, (Step S51). Therefore, the always-on microcomputer 10 is initialized to the state just before the power supply to itself starts as a result of the change of the power supply state to the non-permanent microcomputer 20 while operating in the reprogramming mode S51). That is, the microcomputer 10 always starts the processing in the flowchart of FIG. 2 (S). Then, the always-on microcomputer 10 resumes the processing of step S10. In other words, the always-on microcomputer 10 transitions from the reprogramming mode of step S50 to step S10. Thereafter, the always-on microcomputer 10 executes the processing of steps S10 to S30 and operates in the control mode in step S40. Further, in the always-on microcomputer 10 in the control mode, the non-regular power supply monitoring section 16 detects whether the state of the power supply to the non-permanent microcomputer 20 has been changed from the stop state to the supply state S41). The normal microcomputer 10 transits to step S30 as a result of the power supply to the microcomputer 20 being changed from the paused state to the supplied state in an emergency as shown at time t12 and t13 during operation in the control mode.

On the other hand, as shown at time t12, when the power supply to the non-permanent microcomputer 20 is restored, the reset is released therefrom, and the processing in the flowchart of Fig. 2 is started (S). At this time, the microcomputer 10 is not always operating in the reprogramming mode, and does not transmit a rewrite request. For this reason, the non-permanent microcomputer 20 transitions to step S20 without transitioning to the on-board mode.

Thereafter, the non-permanent microcomputer 20 detects the abnormal state of the flash ROM in the determination at step S20 as indicated at time t14, and proceeds to the reprogramming mode of step S50 to resume the rewriting of the flash ROM. As a result, the non-permanent microcomputer 20 can rewrite the flash ROM again. Since the non-permanent microcomputer 20 operates in the reprogramming mode, it sends a rewrite request as shown at time t14. That is, the rewrite request is transmitted to the always-on microcomputer 10 as shown at time t14.

As a result, the always-on microcomputer 10 receives the switching request from the determination unit 40 in the determination in step S30, and proceeds to the reprogramming mode in step S50. In other words, the always-on microcomputer 10 detects the switching request in the determination in step S30, and therefore, is shifted to the reprogramming mode. Therefore, the flash ROM 11 can be rewritten in the microcomputer 10 at all times. As described above, after the non-permanent microcomputer 20 is started, the always-on microcomputer 10 can again detect the rewrite request at the judgment at step S30 and transit to the reprogramming mode.

As described above, the always-on microcomputer 10 is configured to detect any change in the power supply state to the non-normal microcomputer 20 when the non-continuous power supply monitoring section 16 is in the process of rewriting the control program . Therefore, when instantaneous interruption of power to the non-permanent microcomputer 20 occurs at the time t11 while the always-on microcomputer 10 is executing the rewrite processing, in the always-on microcomputer 10, The non-regular power supply monitoring unit 16 detects that the state of the power supply to the power supply monitoring unit 20 has been changed from the supply state to the stop state. In this case, it is preferable that the microcomputer 10 always keeps rewriting its own control software, that is, rewriting of the flash ROM 11.

Thus, it is possible to restrain the control software from being updated only by the microcomputer 10 at all times. That is, inconsistency in the control software generated between the always-on microcomputer 10 and the non-always-on microcomputer 20 can be suppressed. In other words, while the continuous microcomputer 10 continuously rewrites the control software and the control software is updated, it is possible to suppress the situation where the control software is not updated in the non-permanent microcomputer 20.

The first combination will be described. When the non-permanent microcomputer re-writes to the flash ROM and instantaneous interruption of power to the microcomputer always occurs, the ECU of the comparative example operates as shown in the timing diagram of Fig.

If the momentary interruption of the power to the always-on microcomputer occurs as shown at time t51 while the non-permanent microcomputer is executing the rewrite processing, the rewrite processing is interrupted in all microcomputers in the ECU of the comparative example. That is, rewrite processing is blocked in the non-permanent microcomputer and the always-on microcomputer. However, since the microcomputer is not always rewriting the flash ROM at this point in time, the abnormal state of the flash ROM does not occur.

Thereafter, when the power supply to the always-on microcomputer is restored as shown at time t52, the reset is always released from the microcomputer and the processing in the flow chart of Fig. 2 is started (S). At this time, power supply to the non-permanent microcomputer is stopped. As a result, the always-on microcomputer proceeds to step S20 subsequent to step S10. Since the always-on microcomputer does not detect any abnormality in the flash ROM in the determination in step S20, the flow proceeds to step S30. Also, since the power supply to the non-permanent microcomputer is stopped in step S30 and the microcomputer is not always receiving a rewrite request at all times. The control proceeds to the control mode of step S40.

Thereafter, when the power supply is started, the non-permanent microcomputer starts the processing in the flow chart of FIG. 2 (S). At this time, the microcomputer is always operating in the control mode. For this reason, the non-permanent microcomputer proceeds to step S20. In addition, the non-permanent microcomputer detects the abnormal state of the flash ROM in the determination in step S20, and proceeds to the reprogramming mode of step S50 to resume the rewriting of the flash ROM. At this point, the always-on microcomputer operates in the control mode, while the non-always-on microcomputer operates in the reprogramming mode. For this reason, the always-on microcomputer detects the abnormal state in the state of the non-normal microcomputer.

On the other hand, the ECU 100 operates as shown in the timing chart of Fig. If the momentary interruption of power to the non-permanent microcomputer 20 occurs as shown at time t11 while the non-permanent microcomputer 20 is executing the rewrite processing, the rewrite processing of the non-permanent microcomputer 20 .

When the momentary interruption of the power to the always-on microcomputer 10 occurs as shown at time t21 while the non-permanent microcomputer 20 is executing the rewrite processing, the rewrite processing of all the microcomputers in the ECU 10 . That is, rewrite processing is interrupted in the non-permanent microcomputer 20 and the always-on microcomputer 10. However, since the always-on microcomputer 10 is not rewriting the flash ROM at this time, the abnormal state of the flash ROM does not occur.

Thereafter, when the power supply to the always-on microcomputer is restored as shown at time t22, the always-on microcomputer 10 proceeds to the control mode of step S40 similarly to the always-on microcomputer in the ECU of the comparative example. Also, in the always-on microcomputer 10 in the control mode, the non-regular power supply monitoring unit 16 detects whether the power supply state to the non-permanent microcomputer 10 is changed from the stop state to the supply state (step S41 ).

The microcomputer 10 continuously transitions to step S30 as a result that the state of the power supply to the non-permanent microcomputer 20 is changed from the stop state to the supply state as shown at time t23 while the microcomputer 10 is operating in the control mode.

On the other hand, when the power supply is started, the non-permanent microcomputer 20 starts the processing in the flow chart of FIG. 2 (S). Since the always-on microcomputer 10 is not operating in the reprogramming mode at this time, it does not transmit the rewrite request. For this reason, the non-permanent microcomputer 20 transitions to step S20 instead of transitioning to the on-board mode.

Thereafter, the non-permanent microcomputer 20 detects the abnormal state of the flash ROM in the judgment at the step S20 as shown at the time t24, proceeds to the reprogramming mode of the step S50 and rewrites the flash ROM 21 Resume. As a result, the non-permanent microcomputer 20 can rewrite the flash ROM 21 again. Since the non-permanent microcomputer 20 operates in the reprogramming mode, it sends a rewrite request as shown at time t24. That is, the rewrite request is transmitted to the always-on microcomputer 10 as shown at time t24.

At this time, the always-on microcomputer 10 is not operating in the control mode. For this reason, the microcomputer 10 always receives the switching request from the determination unit 40 in the determination in step S30, and proceeds to the reprogramming mode in step S50. In other words, the always-on microcomputer 10 detects the switching request in the determination at step S30, and is shifted to the reprogramming mode. As a result, the always-on microcomputer 10 is shifted to the reprogramming mode and the flash ROM 11 is brought into a state in which it can be rewritten. As described above, after the non-permanent microcomputer 20 is started, the microcomputer 10 can always detect the rewrite request in the judgment in step S30 and transit to the reprogramming mode.

As described so far, the ECU 100 includes the microcomputer 10 and the non-permanent microcomputer 20 at all times. The always-on microcomputer 10 detects any change in the power supply state to the non-permanent microcomputer while rewriting the control software. The always-on microcomputer 10, when detecting a change in the power supply state, causes processing to be shifted to the determination of step S10.

Therefore, when the state of the power supply to the non-permanent microcomputer 20 is changed from the stop state to the supply state while the microcomputer 10 is always executing the rewrite processing, the ECU 100 always operates the microcomputer 20 10 and the non-permanent microcomputer 20 execute the judgment of step S10. That is, the ECU 100 can always synchronize the microcomputer 10 and the non-permanent microcomputer 20 with each other with respect to the execution timing of the determination in step S10.

Therefore, even when the state of the power supply to the non-permanent microcomputer 20 is changed from the stop state to the supply state while the microcomputer 10 is always executing the rewrite processing, the ECU 100 always operates the microcomputer 20 10 does not instruct the non-permanent microcomputer 20 to operate in the reprogramming mode. For this reason, in the ECU 100, it is possible to inhibit the non-permanent microcomputer 20 from operating in the on-board mode while the microcomputer 10 is always executing the rewrite processing. As a result, malfunctions in the ECU 100 can be suppressed.

When the state of power supply to the non-permanent microcomputer 20 is changed from the supply state to the stop state while the microcomputer 10 is always rewriting the control software, the determination of step S10 is executed. Since the power supply is stopped at this point, the non-permanent microcomputer 20 does not operate. Therefore, in the ECU 100, it is possible to inhibit the non-permanent microcomputer 20 from operating in the on-board mode while the microcomputer always executes the rewrite processing. As a result, in the ECU 100, malfunction can be suppressed.

That is, in the ECU including the always-on microcomputer and the non-always-on microcomputer, the start timing of the power supply, that is, the start timing is different. In the ECU 100, because of the difference in start-up, when the microcomputer 10 always retries after re-writing fails due to instantaneous power cut-off (at the time of re-writing again) Can be suppressed. As a result, the ECU 100 can normally execute the transition to the reprogramming mode upon retry.

The ECU 100 also detects the start of the microcomputer 20 when the microcomputer 10 is normally operating in the control mode and shifts to the determination of step S30 so that the microcomputer 20 It is possible to cope with the retry after the writing failure.

It should be noted that the processing or flow diagram of the flowchart of the present application includes sections (also referred to as steps), wherein each section is represented, for example, as S10. Further, each section may be divided into several subsections, while several sections may be combined into single sections. Furthermore, each of the sections thus configured may also be referred to as a device, module or means.

Although the present disclosure has been described with reference to its embodiments, it will be understood that the present disclosure is not limited to those embodiments or constructions. This disclosure is intended to cover various modifications and equivalent arrangements. In addition, various combinations and configurations, other combinations and configurations, including more or fewer elements or only a single element are within the spirit and scope of the present disclosure.

The present invention relates to a flash ROM and a flash memory that can be used in a flash ROM and a flash memory. And a control unit for controlling the power supply to be supplied to the power supply unit when the power supply is turned off.

Claims

An electronic control unit mounted on an object,
A rewritable memory (11, 21) storing control software and reprogramming software;
An uninterruptible power supply system microcomputer (20) operating in a control mode as an operation mode based on control software and operating in a reprogramming mode as an operation mode based on reprogramming software, said microcomputer (20) Wherein the non-ordinary power supply system microcomputer is connected to the power supply according to the operation of the user and is supplied with power from the power supply, and is disconnected from the power supply according to the operation of the user to stop power supply; And
A normal power supply system which operates in a control mode and a reprogramming mode; a microcomputer (10) - a constant power supply system. The microcomputer is fixedly connected to a power source and receives power from the power source without user operation.
Each of the non-ordinary power supply system microcomputer and the constant power supply system microcomputer includes:
A first mode determination device (SlO) for determining whether the power supply is operating in an on-board mode when it starts to supply power, an on-board mode in which the electronic control unit is not operated under the condition that the electronic control unit is mounted on the object, Unlike the control and reprogramming modes in which a unit is executed under the conditions imposed on the object; And
If it is determined that the first mode determination device is not operating in the on-board mode, a second mode determination device (S20) that determines whether or not to operate in the re-program mode according to the determination of whether the control software is normally written in the memory
Including,
If it is determined that the control software has not been normally written into the memory, the second mode determination device determines to operate in the reprogramming mode and instructs the other microcomputer to operate in the reprogramming mode,
If the first mode determination device is not instructed to operate in the reprogramming mode, the first mode determination device determines that it is not operating in the on-board mode,
When the first mode determination device is instructed to operate in the reprogramming mode, the first mode determination device determines to operate in the on-board mode,
When the operation is performed in the reprogramming mode and the control software is being rewritten, the non-continuous power supply system microcomputer sets the first transition device S51 to detect a change in the power supply state of the non-continuous power supply system microcomputer Including,
When the first transition device detects that the power supply status has been changed, the first transition device switches the processing to the determination performed by the first mode determination device
Electronic control unit.

The method according to claim 1,
Wherein each of the non-ordinary power supply system microcomputer and the always-power-supplying microcomputer includes a third mode determination device (S30) for determining whether the second mode determination device is operating in the control mode when determining that the second mode determination device is not operating in the reprogramming mode Further comprising:
If it is determined that the normal power supply system microcomputer is operated in the control mode and the operation is being executed in the control mode, whether or not the power supply state of the non-normal power supply system microcomputer is changed from the stop state to the supply state Further comprising a second transition device (S41)
If the second transition device determines that the power supply status has been changed, the second transition device switches the processing to the determination by the second mode determination device
Electronic control unit.

3. The method according to claim 1 or 2,
Wherein the normal power supply system microcomputer detects whether the power supply state for the non-normal power supply system microcomputer is changed from the supply state to the stop state while the operation is performed in the programming mode and the control software is being rewritten,
When the always-on power supply system microcomputer detects that the power supply status has been changed, the always-on power supply system microcomputer blocks the rewrite of the control software
Electronic control unit.